A Homomorphic Secret Sharing (HSS) scheme is a secret-sharing scheme that shares a secret $x$ among $s$ servers, and additionally allows an output client to reconstruct some function $f(x)$ using information that can be locally computed by each server. A key parameter in HSS schemes is download rate, which quantifies how much information the output client needs to download from the servers. Often, download rate is improved by amortizing over $\ell$ instances of the problem, making $\ell$ also a key parameter of interest. Recent work (Fosli, Ishai, Kolobov, and Wootters 2022) established a limit on the download rate of linear HSS schemes for computing low-degree polynomials and constructed schemes that achieve this optimal download rate; their schemes required amortization over $\ell = \Omega(s \log(s))$ instances of the problem. Subsequent work (Blackwell and Wootters, 2023) completely characterized linear HSS schemes that achieve optimal download rate in terms of a coding-theoretic notion termed optimal labelweight codes. A consequence of this characterization was that $\ell = \Omega(s \log(s))$ is in fact necessary to achieve optimal download rate. In this paper, we characterize all linear HSS schemes, showing that schemes of any download rate are equivalent to a generalization of optimal labelweight codes. This equivalence is constructive and provides a way to obtain an explicit linear HSS scheme from any linear code. Using this characterization, we present explicit linear HSS schemes with slightly sub-optimal rate but with much improved amortization $\ell = O(s)$. Our constructions are based on algebraic geometry codes (specifically Hermitian codes and Goppa codes).

翻译：同态秘密共享（HSS）方案是一种秘密共享方案，它将秘密 $x$ 分发给 $s$ 个服务器，并允许输出客户端利用每个服务器本地计算的信息重构某个函数 $f(x)$。HSS方案的一个关键参数是下载速率，它量化了输出客户端需要从服务器下载的信息量。通常，通过对问题的 $\ell$ 个实例进行分摊来改进下载速率，这使得 $\ell$ 也成为另一个关键参数。近期工作（Fosli、Ishai、Kolobov和Wootters，2022）确定了用于计算低次多项式的线性HSS方案的下载速率极限，并构造了达到该最优下载速率的方案；这些方案需要对问题的 $\ell = \Omega(s \log(s))$ 个实例进行分摊。后续工作（Blackwell和Wootters，2023）利用称为最优标签权重编码的编码理论概念，完整刻画了达到最优下载速率的线性HSS方案。这一刻画的推论是，$\ell = \Omega(s \log(s))$ 实际上是实现最优下载速率的必要条件。在本文中，我们刻画了所有线性HSS方案，表明任意下载速率的方案都等价于最优标签权重编码的推广。这种等价是构造性的，提供了一种从任意线性编码获得显式线性HSS方案的方法。利用这一刻画，我们提出了显式线性HSS方案，其速率略低于最优，但具有显著改进的分摊参数 $\ell = O(s)$。我们的构造基于代数几何编码（特别是埃尔米特编码和戈帕编码）。